Chrome SameSite验证阻止cookie更新

时间:2020-10-03 18:30:53

标签: .net cookies .net-4.6 httpcookie samesite

我有一个旧的.net站点(使用.net 4.6),当用户从一页转到另一页时,该站点在cookie中存储了一些临时值。该站点只能在我们公司的内部网络上访问,并且仅使用HTTP。当前是流程:

Page 1 -> Creates the cookie. Stores session token.
Page 2 -> Adds receipt id to cookie (happens in .net code - see below)
Page 3 -> Reads receipt id from cookie and does something with it. 

这一切在Chrome将SameSite=Lax设置为默认值之前就可以使用。我进行了测试,并且如果我禁用了chrome://flags/#same-site-by-default-cookies(本质上设置了SameSite=None),则第2页可以成功更新cookie,一切正常。没有SameSite=None,Page2无法更新cookie,因此Page 3无法使用它(cookie实际上不会更新)。

设置Cookie的代码:

/// <summary>
/// This function is used to update UserCookieWrapper values
/// </summary>
/// <param name="item">Can be a stirng</param>
/// <param name="val">Can be a string</param>
/// <param name="expireHours">Must be a double</param>
private static void UpdateCookieVal(COOKIE_ITEM item, string val, double expireHours){
     //get the existing cookie (or new if not exists)
     HttpCookie cookie = GetAppCookie(true);
     
     //modify its contents & meta.
     if(RememberMe)
         cookie.Expires = DateTime.Now.AddHours(clsBLLConstants.APP_COOKIE_EXIPRYHOURS);

     cookie.Values[item.ToString()] = clsEncryption.EncryptPassword(val, clsBLLConstants.initVector, clsBLLConstants.saltValue, clsBLLConstants.passPhrase, clsBLLConstants.hashAlgorithm, clsBLLConstants.passwordIterations, clsBLLConstants.keySize);
     //add back to the http response to send back to the browser
     HttpContext.Current.Response.Cookies.Add(cookie);
     try
        {
           HttpContext.Current.Response.Cookies.Add(cookie);
     } catch (Exception exception) {
           clsBLLErrorHandler.WriteError(exception);
     }

}

这是cookie的样子: enter image description here

问题:

  1. 我的所有页面都在同一站点上。为什么SameSite在这里有意义?
  2. 该如何解决?

0 个答案:

没有答案